xmrig | 387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
Size

1.8MB
MD5

16382ad2f2e482239932e26b97d95526
SHA1

41dc04f1e25dc6fad00792769503c9c9a167b1a2
SHA256

387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5
SHA512

364833f3be0f265f823b7d26a7c405fc773ee6ca895b7b8fa312bfc7473e67147233cf018730cfa6929acdc205b4bc6ce8538ebe271ea6dd967cfcbed3667419
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQR:GemTLkNdfE0pZyu

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000012118-5.dat	xmrig
behavioral1/files/0x0009000000015d2a-6.dat	xmrig
behavioral1/files/0x0008000000015d59-14.dat	xmrig
behavioral1/files/0x0008000000015d41-13.dat	xmrig
behavioral1/files/0x0007000000015ec4-24.dat	xmrig
behavioral1/files/0x0007000000015f25-29.dat	xmrig
behavioral1/files/0x0008000000016d43-40.dat	xmrig
behavioral1/files/0x0006000000016d67-52.dat	xmrig
behavioral1/files/0x0006000000016de8-73.dat	xmrig
behavioral1/files/0x0006000000016ecf-84.dat	xmrig
behavioral1/files/0x000600000001749c-96.dat	xmrig
behavioral1/files/0x0005000000018739-128.dat	xmrig
behavioral1/files/0x0005000000018704-124.dat	xmrig
behavioral1/files/0x00050000000186f4-120.dat	xmrig
behavioral1/files/0x00050000000186f1-116.dat	xmrig
behavioral1/files/0x00050000000186ed-112.dat	xmrig
behavioral1/files/0x0005000000018686-102.dat	xmrig
behavioral1/files/0x00050000000186e7-107.dat	xmrig
behavioral1/files/0x000600000001755b-100.dat	xmrig
behavioral1/files/0x0006000000017497-92.dat	xmrig
behavioral1/files/0x0006000000017049-88.dat	xmrig
behavioral1/files/0x0006000000016df3-80.dat	xmrig
behavioral1/files/0x0006000000016dea-76.dat	xmrig
behavioral1/files/0x0006000000016d9f-68.dat	xmrig
behavioral1/files/0x0006000000016d77-64.dat	xmrig
behavioral1/files/0x0006000000016d6f-60.dat	xmrig
behavioral1/files/0x0006000000016d6b-56.dat	xmrig
behavioral1/files/0x0006000000016d54-48.dat	xmrig
behavioral1/files/0x0006000000016d4b-44.dat	xmrig
behavioral1/files/0x000900000001610d-37.dat	xmrig
behavioral1/files/0x0007000000015f7b-33.dat	xmrig
behavioral1/files/0x0008000000015d81-21.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1740	RYLtkAC.exe
2380	xgjBnjg.exe
1752	xdFKaqO.exe
2076	RUvlGGv.exe
2500	kBEFwpJ.exe
2416	BISZtqG.exe
2820	MLkowRA.exe
2892	FkrOWCa.exe
2952	bsboEst.exe
2932	JUkYRzz.exe
2684	eAfAbSW.exe
2792	uRhZtPM.exe
2972	lQUkKny.exe
1776	GWyRPcG.exe
2788	bGDgpXQ.exe
2672	OlEJAbd.exe
2740	uiBxIoe.exe
2508	HlPllrO.exe
2484	yLinYWH.exe
572	IISHhpO.exe
1692	eTSeezA.exe
1756	ENVNWiJ.exe
1040	HvWblfZ.exe
1580	dRJrkGd.exe
1680	FoLgXfR.exe
2028	QGMSkRJ.exe
324	ubZYmmW.exe
308	SbLwtqO.exe
1764	HfIICcV.exe
2452	GskufCB.exe
2196	wHFNanS.exe
2440	guFyNaV.exe
2344	QlodFGJ.exe
1164	DUABhIj.exe
1796	WdjmbTO.exe
1688	MxVfvMD.exe
2660	bKHvUcd.exe
2544	AYzDUWk.exe
832	pLCKjoq.exe
988	joeAnhK.exe
2540	mfDLaVJ.exe
1940	beyyjFI.exe
1348	yByOifb.exe
2572	rIxXMJj.exe
1552	ueZUImp.exe
1296	uPPfTHD.exe
2148	BOVsaPm.exe
3036	zjVlXGW.exe
992	nBugCJI.exe
2488	tUIReFR.exe
2240	IbgrhkA.exe
3064	frwSXTi.exe
1964	TDRDCmA.exe
1652	xXhblWH.exe
1624	RWAeXNV.exe
1408	csDfncA.exe
2512	ePqJedF.exe
1704	RnfzrEK.exe
1576	pBySWhq.exe
2760	BcedpnX.exe
2480	KCvKOSd.exe
2908	usfdTUz.exe
2808	ZFewcJa.exe
2996	vGeNQBn.exe

Loads dropped DLL 64 IoCs

pid	Process
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xikJrqj.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\EJvaJQR.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\AjUnhcb.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\tyEBggL.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\WrMtDhV.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ZqxKVKG.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ubZYmmW.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\AxGfouy.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\tBMfMcf.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\cRSTDdd.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\WExmBNb.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\GJkQmXF.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\fcGYykY.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\WdYWZfo.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\jHtxnez.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\FITUWXF.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\qXkfzPr.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\yNfuvpv.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\PnHYJsN.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\iiRVKqb.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\NjdBrfz.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\bhVWTvT.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\qwDfhAf.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\AwlfiQW.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\FMmlcEi.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\kifaTyV.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\WrFZpxV.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\IBYhIbx.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\PILgibw.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\WCPnetA.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\gChEoRR.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\DxzHJIl.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\QblZyyu.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\jmxpwFv.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\fkeHyQf.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\UmFIWBy.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\PSszSlY.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\yfUYUgz.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\pmlpIQy.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\vVSdQik.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\bGDgpXQ.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\dCwRXlF.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\SHVcsvt.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\VGDwwRe.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\TdbSCgm.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\VBtQMyq.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\rmqBbls.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ClJZwWL.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\horLIag.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\QHBMvVC.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\FbmAnKx.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\mkRFQgs.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\MjStxsY.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\DNqMlLU.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\PLqdTRN.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\wNHSVEL.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\lAZNrpX.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\QRssGCC.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\HFofyaP.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\BBDFQTD.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\uJWWTBs.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\SbvbaSY.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\UJbuWPm.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\uRhZtPM.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1740	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	31
PID 2604 wrote to memory of 1740	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	31
PID 2604 wrote to memory of 1740	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	31
PID 2604 wrote to memory of 2380	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	32
PID 2604 wrote to memory of 2380	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	32
PID 2604 wrote to memory of 2380	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	32
PID 2604 wrote to memory of 1752	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	33
PID 2604 wrote to memory of 1752	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	33
PID 2604 wrote to memory of 1752	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	33
PID 2604 wrote to memory of 2076	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	34
PID 2604 wrote to memory of 2076	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	34
PID 2604 wrote to memory of 2076	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	34
PID 2604 wrote to memory of 2500	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	35
PID 2604 wrote to memory of 2500	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	35
PID 2604 wrote to memory of 2500	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	35
PID 2604 wrote to memory of 2416	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	36
PID 2604 wrote to memory of 2416	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	36
PID 2604 wrote to memory of 2416	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	36
PID 2604 wrote to memory of 2820	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	37
PID 2604 wrote to memory of 2820	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	37
PID 2604 wrote to memory of 2820	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	37
PID 2604 wrote to memory of 2892	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	38
PID 2604 wrote to memory of 2892	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	38
PID 2604 wrote to memory of 2892	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	38
PID 2604 wrote to memory of 2952	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	39
PID 2604 wrote to memory of 2952	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	39
PID 2604 wrote to memory of 2952	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	39
PID 2604 wrote to memory of 2932	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	40
PID 2604 wrote to memory of 2932	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	40
PID 2604 wrote to memory of 2932	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	40
PID 2604 wrote to memory of 2684	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	41
PID 2604 wrote to memory of 2684	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	41
PID 2604 wrote to memory of 2684	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	41
PID 2604 wrote to memory of 2792	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	42
PID 2604 wrote to memory of 2792	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	42
PID 2604 wrote to memory of 2792	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	42
PID 2604 wrote to memory of 2972	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	43
PID 2604 wrote to memory of 2972	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	43
PID 2604 wrote to memory of 2972	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	43
PID 2604 wrote to memory of 1776	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	44
PID 2604 wrote to memory of 1776	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	44
PID 2604 wrote to memory of 1776	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	44
PID 2604 wrote to memory of 2788	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	45
PID 2604 wrote to memory of 2788	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	45
PID 2604 wrote to memory of 2788	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	45
PID 2604 wrote to memory of 2672	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	46
PID 2604 wrote to memory of 2672	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	46
PID 2604 wrote to memory of 2672	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	46
PID 2604 wrote to memory of 2740	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	47
PID 2604 wrote to memory of 2740	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	47
PID 2604 wrote to memory of 2740	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	47
PID 2604 wrote to memory of 2508	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	48
PID 2604 wrote to memory of 2508	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	48
PID 2604 wrote to memory of 2508	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	48
PID 2604 wrote to memory of 2484	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	49
PID 2604 wrote to memory of 2484	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	49
PID 2604 wrote to memory of 2484	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	49
PID 2604 wrote to memory of 572	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	50
PID 2604 wrote to memory of 572	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	50
PID 2604 wrote to memory of 572	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	50
PID 2604 wrote to memory of 1692	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	51
PID 2604 wrote to memory of 1692	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	51
PID 2604 wrote to memory of 1692	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	51
PID 2604 wrote to memory of 1756	2604	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	52

C:\Users\Admin\AppData\Local\Temp\387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
"C:\Users\Admin\AppData\Local\Temp\387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\System\RYLtkAC.exe
  C:\Windows\System\RYLtkAC.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\xgjBnjg.exe
  C:\Windows\System\xgjBnjg.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\xdFKaqO.exe
  C:\Windows\System\xdFKaqO.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\RUvlGGv.exe
  C:\Windows\System\RUvlGGv.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\kBEFwpJ.exe
  C:\Windows\System\kBEFwpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\BISZtqG.exe
  C:\Windows\System\BISZtqG.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\MLkowRA.exe
  C:\Windows\System\MLkowRA.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\FkrOWCa.exe
  C:\Windows\System\FkrOWCa.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\bsboEst.exe
  C:\Windows\System\bsboEst.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\JUkYRzz.exe
  C:\Windows\System\JUkYRzz.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\eAfAbSW.exe
  C:\Windows\System\eAfAbSW.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\uRhZtPM.exe
  C:\Windows\System\uRhZtPM.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\lQUkKny.exe
  C:\Windows\System\lQUkKny.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\GWyRPcG.exe
  C:\Windows\System\GWyRPcG.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\bGDgpXQ.exe
  C:\Windows\System\bGDgpXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\OlEJAbd.exe
  C:\Windows\System\OlEJAbd.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\uiBxIoe.exe
  C:\Windows\System\uiBxIoe.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\HlPllrO.exe
  C:\Windows\System\HlPllrO.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\yLinYWH.exe
  C:\Windows\System\yLinYWH.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\IISHhpO.exe
  C:\Windows\System\IISHhpO.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\eTSeezA.exe
  C:\Windows\System\eTSeezA.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ENVNWiJ.exe
  C:\Windows\System\ENVNWiJ.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\HvWblfZ.exe
  C:\Windows\System\HvWblfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\dRJrkGd.exe
  C:\Windows\System\dRJrkGd.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\FoLgXfR.exe
  C:\Windows\System\FoLgXfR.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\ubZYmmW.exe
  C:\Windows\System\ubZYmmW.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\QGMSkRJ.exe
  C:\Windows\System\QGMSkRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\SbLwtqO.exe
  C:\Windows\System\SbLwtqO.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\HfIICcV.exe
  C:\Windows\System\HfIICcV.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\GskufCB.exe
  C:\Windows\System\GskufCB.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\wHFNanS.exe
  C:\Windows\System\wHFNanS.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\guFyNaV.exe
  C:\Windows\System\guFyNaV.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\QlodFGJ.exe
  C:\Windows\System\QlodFGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\DUABhIj.exe
  C:\Windows\System\DUABhIj.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\WdjmbTO.exe
  C:\Windows\System\WdjmbTO.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\MxVfvMD.exe
  C:\Windows\System\MxVfvMD.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\bKHvUcd.exe
  C:\Windows\System\bKHvUcd.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\AYzDUWk.exe
  C:\Windows\System\AYzDUWk.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\pLCKjoq.exe
  C:\Windows\System\pLCKjoq.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\joeAnhK.exe
  C:\Windows\System\joeAnhK.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\mfDLaVJ.exe
  C:\Windows\System\mfDLaVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\beyyjFI.exe
  C:\Windows\System\beyyjFI.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\yByOifb.exe
  C:\Windows\System\yByOifb.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\ueZUImp.exe
  C:\Windows\System\ueZUImp.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\rIxXMJj.exe
  C:\Windows\System\rIxXMJj.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\uPPfTHD.exe
  C:\Windows\System\uPPfTHD.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\BOVsaPm.exe
  C:\Windows\System\BOVsaPm.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\zjVlXGW.exe
  C:\Windows\System\zjVlXGW.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\nBugCJI.exe
  C:\Windows\System\nBugCJI.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\tUIReFR.exe
  C:\Windows\System\tUIReFR.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\IbgrhkA.exe
  C:\Windows\System\IbgrhkA.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\frwSXTi.exe
  C:\Windows\System\frwSXTi.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\TDRDCmA.exe
  C:\Windows\System\TDRDCmA.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\xXhblWH.exe
  C:\Windows\System\xXhblWH.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\RWAeXNV.exe
  C:\Windows\System\RWAeXNV.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\csDfncA.exe
  C:\Windows\System\csDfncA.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\ePqJedF.exe
  C:\Windows\System\ePqJedF.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\RnfzrEK.exe
  C:\Windows\System\RnfzrEK.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\pBySWhq.exe
  C:\Windows\System\pBySWhq.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\BcedpnX.exe
  C:\Windows\System\BcedpnX.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\KCvKOSd.exe
  C:\Windows\System\KCvKOSd.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\usfdTUz.exe
  C:\Windows\System\usfdTUz.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ZFewcJa.exe
  C:\Windows\System\ZFewcJa.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\vGeNQBn.exe
  C:\Windows\System\vGeNQBn.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\EfIBdaI.exe
  C:\Windows\System\EfIBdaI.exe
  2⤵
  PID:2680
- C:\Windows\System\iDpglIv.exe
  C:\Windows\System\iDpglIv.exe
  2⤵
  PID:2328
- C:\Windows\System\dZgCOVC.exe
  C:\Windows\System\dZgCOVC.exe
  2⤵
  PID:1888
- C:\Windows\System\BhNOaRX.exe
  C:\Windows\System\BhNOaRX.exe
  2⤵
  PID:576
- C:\Windows\System\rUNoxUj.exe
  C:\Windows\System\rUNoxUj.exe
  2⤵
  PID:320
- C:\Windows\System\AxGfouy.exe
  C:\Windows\System\AxGfouy.exe
  2⤵
  PID:908
- C:\Windows\System\KAxQbpK.exe
  C:\Windows\System\KAxQbpK.exe
  2⤵
  PID:2164
- C:\Windows\System\MxzikOr.exe
  C:\Windows\System\MxzikOr.exe
  2⤵
  PID:1972
- C:\Windows\System\ygPYmdu.exe
  C:\Windows\System\ygPYmdu.exe
  2⤵
  PID:2292
- C:\Windows\System\IApEYSx.exe
  C:\Windows\System\IApEYSx.exe
  2⤵
  PID:1884
- C:\Windows\System\OdeqGML.exe
  C:\Windows\System\OdeqGML.exe
  2⤵
  PID:3040
- C:\Windows\System\bDfTJAE.exe
  C:\Windows\System\bDfTJAE.exe
  2⤵
  PID:3048
- C:\Windows\System\PEkSkET.exe
  C:\Windows\System\PEkSkET.exe
  2⤵
  PID:3052
- C:\Windows\System\PSszSlY.exe
  C:\Windows\System\PSszSlY.exe
  2⤵
  PID:2116
- C:\Windows\System\jpYTofM.exe
  C:\Windows\System\jpYTofM.exe
  2⤵
  PID:2032
- C:\Windows\System\vpGqmwM.exe
  C:\Windows\System\vpGqmwM.exe
  2⤵
  PID:1380
- C:\Windows\System\zWnifXz.exe
  C:\Windows\System\zWnifXz.exe
  2⤵
  PID:928
- C:\Windows\System\SQKVCuO.exe
  C:\Windows\System\SQKVCuO.exe
  2⤵
  PID:1512
- C:\Windows\System\rVHtBuC.exe
  C:\Windows\System\rVHtBuC.exe
  2⤵
  PID:1772
- C:\Windows\System\sghsBeP.exe
  C:\Windows\System\sghsBeP.exe
  2⤵
  PID:1612
- C:\Windows\System\XqhxFXJ.exe
  C:\Windows\System\XqhxFXJ.exe
  2⤵
  PID:952
- C:\Windows\System\dDRpTat.exe
  C:\Windows\System\dDRpTat.exe
  2⤵
  PID:1976
- C:\Windows\System\luOujQp.exe
  C:\Windows\System\luOujQp.exe
  2⤵
  PID:752
- C:\Windows\System\IRdXdce.exe
  C:\Windows\System\IRdXdce.exe
  2⤵
  PID:1876
- C:\Windows\System\TaffVpe.exe
  C:\Windows\System\TaffVpe.exe
  2⤵
  PID:2284
- C:\Windows\System\xBjJMup.exe
  C:\Windows\System\xBjJMup.exe
  2⤵
  PID:2744
- C:\Windows\System\IgIKXrw.exe
  C:\Windows\System\IgIKXrw.exe
  2⤵
  PID:1404
- C:\Windows\System\iiRwYIP.exe
  C:\Windows\System\iiRwYIP.exe
  2⤵
  PID:2388
- C:\Windows\System\DrAyKXC.exe
  C:\Windows\System\DrAyKXC.exe
  2⤵
  PID:2756
- C:\Windows\System\CruDTcH.exe
  C:\Windows\System\CruDTcH.exe
  2⤵
  PID:1720
- C:\Windows\System\DspBsOm.exe
  C:\Windows\System\DspBsOm.exe
  2⤵
  PID:1436
- C:\Windows\System\vpeXhdE.exe
  C:\Windows\System\vpeXhdE.exe
  2⤵
  PID:2944
- C:\Windows\System\CFXVtWR.exe
  C:\Windows\System\CFXVtWR.exe
  2⤵
  PID:2712
- C:\Windows\System\iAlLoUN.exe
  C:\Windows\System\iAlLoUN.exe
  2⤵
  PID:2796
- C:\Windows\System\mDYEEVO.exe
  C:\Windows\System\mDYEEVO.exe
  2⤵
  PID:1844
- C:\Windows\System\SnfTKJx.exe
  C:\Windows\System\SnfTKJx.exe
  2⤵
  PID:1644
- C:\Windows\System\btETrEH.exe
  C:\Windows\System\btETrEH.exe
  2⤵
  PID:892
- C:\Windows\System\BWIXJhy.exe
  C:\Windows\System\BWIXJhy.exe
  2⤵
  PID:1324
- C:\Windows\System\IDtZfAF.exe
  C:\Windows\System\IDtZfAF.exe
  2⤵
  PID:2592
- C:\Windows\System\CfkWOMS.exe
  C:\Windows\System\CfkWOMS.exe
  2⤵
  PID:1212
- C:\Windows\System\ZuKSCRu.exe
  C:\Windows\System\ZuKSCRu.exe
  2⤵
  PID:1588
- C:\Windows\System\jijWAeu.exe
  C:\Windows\System\jijWAeu.exe
  2⤵
  PID:3056
- C:\Windows\System\fjBxmJV.exe
  C:\Windows\System\fjBxmJV.exe
  2⤵
  PID:1140
- C:\Windows\System\TeqxpbF.exe
  C:\Windows\System\TeqxpbF.exe
  2⤵
  PID:3096
- C:\Windows\System\ImqMykz.exe
  C:\Windows\System\ImqMykz.exe
  2⤵
  PID:3116
- C:\Windows\System\PGkwggR.exe
  C:\Windows\System\PGkwggR.exe
  2⤵
  PID:3136
- C:\Windows\System\YTvEpAj.exe
  C:\Windows\System\YTvEpAj.exe
  2⤵
  PID:3152
- C:\Windows\System\CfHjAgm.exe
  C:\Windows\System\CfHjAgm.exe
  2⤵
  PID:3168
- C:\Windows\System\nigbpSA.exe
  C:\Windows\System\nigbpSA.exe
  2⤵
  PID:3196
- C:\Windows\System\ctpjHDw.exe
  C:\Windows\System\ctpjHDw.exe
  2⤵
  PID:3216
- C:\Windows\System\wnvUOzC.exe
  C:\Windows\System\wnvUOzC.exe
  2⤵
  PID:3236
- C:\Windows\System\dAcxnuJ.exe
  C:\Windows\System\dAcxnuJ.exe
  2⤵
  PID:3252
- C:\Windows\System\dttODjq.exe
  C:\Windows\System\dttODjq.exe
  2⤵
  PID:3268
- C:\Windows\System\IGVdNEJ.exe
  C:\Windows\System\IGVdNEJ.exe
  2⤵
  PID:3284
- C:\Windows\System\PAQAamh.exe
  C:\Windows\System\PAQAamh.exe
  2⤵
  PID:3300
- C:\Windows\System\NuROZao.exe
  C:\Windows\System\NuROZao.exe
  2⤵
  PID:3328
- C:\Windows\System\kYGMtrW.exe
  C:\Windows\System\kYGMtrW.exe
  2⤵
  PID:3348
- C:\Windows\System\hsdFkkb.exe
  C:\Windows\System\hsdFkkb.exe
  2⤵
  PID:3364
- C:\Windows\System\mnCfWPx.exe
  C:\Windows\System\mnCfWPx.exe
  2⤵
  PID:3380
- C:\Windows\System\devlWUo.exe
  C:\Windows\System\devlWUo.exe
  2⤵
  PID:3404
- C:\Windows\System\VwZzLQV.exe
  C:\Windows\System\VwZzLQV.exe
  2⤵
  PID:3424
- C:\Windows\System\flsNHGx.exe
  C:\Windows\System\flsNHGx.exe
  2⤵
  PID:3456
- C:\Windows\System\GfjqxDg.exe
  C:\Windows\System\GfjqxDg.exe
  2⤵
  PID:3476
- C:\Windows\System\LlHmDwD.exe
  C:\Windows\System\LlHmDwD.exe
  2⤵
  PID:3496
- C:\Windows\System\IYoHAFR.exe
  C:\Windows\System\IYoHAFR.exe
  2⤵
  PID:3516
- C:\Windows\System\BBDFQTD.exe
  C:\Windows\System\BBDFQTD.exe
  2⤵
  PID:3532
- C:\Windows\System\ARaSzbs.exe
  C:\Windows\System\ARaSzbs.exe
  2⤵
  PID:3556
- C:\Windows\System\llQHNdq.exe
  C:\Windows\System\llQHNdq.exe
  2⤵
  PID:3572
- C:\Windows\System\cwtxCFy.exe
  C:\Windows\System\cwtxCFy.exe
  2⤵
  PID:3588
- C:\Windows\System\XDMRpjV.exe
  C:\Windows\System\XDMRpjV.exe
  2⤵
  PID:3604
- C:\Windows\System\SmeHoxx.exe
  C:\Windows\System\SmeHoxx.exe
  2⤵
  PID:3628
- C:\Windows\System\LyqzPhC.exe
  C:\Windows\System\LyqzPhC.exe
  2⤵
  PID:3652
- C:\Windows\System\uFVzHGi.exe
  C:\Windows\System\uFVzHGi.exe
  2⤵
  PID:3680
- C:\Windows\System\tYWRvcs.exe
  C:\Windows\System\tYWRvcs.exe
  2⤵
  PID:3700
- C:\Windows\System\JWdmgMK.exe
  C:\Windows\System\JWdmgMK.exe
  2⤵
  PID:3720
- C:\Windows\System\MieIPkc.exe
  C:\Windows\System\MieIPkc.exe
  2⤵
  PID:3744
- C:\Windows\System\jPHZiSi.exe
  C:\Windows\System\jPHZiSi.exe
  2⤵
  PID:3760
- C:\Windows\System\pYzckrR.exe
  C:\Windows\System\pYzckrR.exe
  2⤵
  PID:3776
- C:\Windows\System\guyxtvT.exe
  C:\Windows\System\guyxtvT.exe
  2⤵
  PID:3804
- C:\Windows\System\jJvslnF.exe
  C:\Windows\System\jJvslnF.exe
  2⤵
  PID:3824
- C:\Windows\System\xVpixGF.exe
  C:\Windows\System\xVpixGF.exe
  2⤵
  PID:3848
- C:\Windows\System\YukqkEb.exe
  C:\Windows\System\YukqkEb.exe
  2⤵
  PID:3864
- C:\Windows\System\yfUYUgz.exe
  C:\Windows\System\yfUYUgz.exe
  2⤵
  PID:3884
- C:\Windows\System\MjStxsY.exe
  C:\Windows\System\MjStxsY.exe
  2⤵
  PID:3904
- C:\Windows\System\esshUSI.exe
  C:\Windows\System\esshUSI.exe
  2⤵
  PID:3920
- C:\Windows\System\WLaorjV.exe
  C:\Windows\System\WLaorjV.exe
  2⤵
  PID:3940
- C:\Windows\System\rgBsshQ.exe
  C:\Windows\System\rgBsshQ.exe
  2⤵
  PID:3960
- C:\Windows\System\VKQwnZN.exe
  C:\Windows\System\VKQwnZN.exe
  2⤵
  PID:3976
- C:\Windows\System\qOSgaHw.exe
  C:\Windows\System\qOSgaHw.exe
  2⤵
  PID:3992
- C:\Windows\System\RexfEbG.exe
  C:\Windows\System\RexfEbG.exe
  2⤵
  PID:4008
- C:\Windows\System\KKsouSc.exe
  C:\Windows\System\KKsouSc.exe
  2⤵
  PID:4036
- C:\Windows\System\uklEKJg.exe
  C:\Windows\System\uklEKJg.exe
  2⤵
  PID:4052
- C:\Windows\System\enjdTxx.exe
  C:\Windows\System\enjdTxx.exe
  2⤵
  PID:4072
- C:\Windows\System\bPyrUDW.exe
  C:\Windows\System\bPyrUDW.exe
  2⤵
  PID:4088
- C:\Windows\System\qnvgUuh.exe
  C:\Windows\System\qnvgUuh.exe
  2⤵
  PID:2276
- C:\Windows\System\YzPASdY.exe
  C:\Windows\System\YzPASdY.exe
  2⤵
  PID:1696
- C:\Windows\System\ogntsYw.exe
  C:\Windows\System\ogntsYw.exe
  2⤵
  PID:2216
- C:\Windows\System\dttHDKB.exe
  C:\Windows\System\dttHDKB.exe
  2⤵
  PID:2424
- C:\Windows\System\oxAnhqr.exe
  C:\Windows\System\oxAnhqr.exe
  2⤵
  PID:912
- C:\Windows\System\xHsBEzG.exe
  C:\Windows\System\xHsBEzG.exe
  2⤵
  PID:1636
- C:\Windows\System\CJfoung.exe
  C:\Windows\System\CJfoung.exe
  2⤵
  PID:1400
- C:\Windows\System\qBLHSQo.exe
  C:\Windows\System\qBLHSQo.exe
  2⤵
  PID:2836
- C:\Windows\System\bVOYWkj.exe
  C:\Windows\System\bVOYWkj.exe
  2⤵
  PID:1540
- C:\Windows\System\zpudplf.exe
  C:\Windows\System\zpudplf.exe
  2⤵
  PID:1168
- C:\Windows\System\ZqHxoKS.exe
  C:\Windows\System\ZqHxoKS.exe
  2⤵
  PID:2136
- C:\Windows\System\NaIfRBD.exe
  C:\Windows\System\NaIfRBD.exe
  2⤵
  PID:2720
- C:\Windows\System\XYHKwTR.exe
  C:\Windows\System\XYHKwTR.exe
  2⤵
  PID:2188
- C:\Windows\System\RtcKBkd.exe
  C:\Windows\System\RtcKBkd.exe
  2⤵
  PID:2656
- C:\Windows\System\AQPZYuA.exe
  C:\Windows\System\AQPZYuA.exe
  2⤵
  PID:3092
- C:\Windows\System\JXCBvhK.exe
  C:\Windows\System\JXCBvhK.exe
  2⤵
  PID:3132
- C:\Windows\System\otmICqQ.exe
  C:\Windows\System\otmICqQ.exe
  2⤵
  PID:2268
- C:\Windows\System\rLEtlcQ.exe
  C:\Windows\System\rLEtlcQ.exe
  2⤵
  PID:3108
- C:\Windows\System\LmDxaXH.exe
  C:\Windows\System\LmDxaXH.exe
  2⤵
  PID:3244
- C:\Windows\System\YpUzmoY.exe
  C:\Windows\System\YpUzmoY.exe
  2⤵
  PID:3276
- C:\Windows\System\XHBVxgp.exe
  C:\Windows\System\XHBVxgp.exe
  2⤵
  PID:3316
- C:\Windows\System\PEJfGGY.exe
  C:\Windows\System\PEJfGGY.exe
  2⤵
  PID:3184
- C:\Windows\System\mgfztrC.exe
  C:\Windows\System\mgfztrC.exe
  2⤵
  PID:3388
- C:\Windows\System\LPLygLa.exe
  C:\Windows\System\LPLygLa.exe
  2⤵
  PID:3228
- C:\Windows\System\qpVldLk.exe
  C:\Windows\System\qpVldLk.exe
  2⤵
  PID:3264
- C:\Windows\System\CBKBMii.exe
  C:\Windows\System\CBKBMii.exe
  2⤵
  PID:3340
- C:\Windows\System\LDXRUVX.exe
  C:\Windows\System\LDXRUVX.exe
  2⤵
  PID:3420
- C:\Windows\System\TVnnNHp.exe
  C:\Windows\System\TVnnNHp.exe
  2⤵
  PID:3484
- C:\Windows\System\pmlpIQy.exe
  C:\Windows\System\pmlpIQy.exe
  2⤵
  PID:3564
- C:\Windows\System\eDqRFCU.exe
  C:\Windows\System\eDqRFCU.exe
  2⤵
  PID:3640
- C:\Windows\System\byKYwwn.exe
  C:\Windows\System\byKYwwn.exe
  2⤵
  PID:3728
- C:\Windows\System\QZulCFA.exe
  C:\Windows\System\QZulCFA.exe
  2⤵
  PID:3772
- C:\Windows\System\gzSHZhx.exe
  C:\Windows\System\gzSHZhx.exe
  2⤵
  PID:3464
- C:\Windows\System\CAEAaek.exe
  C:\Windows\System\CAEAaek.exe
  2⤵
  PID:3860
- C:\Windows\System\BDBFJRu.exe
  C:\Windows\System\BDBFJRu.exe
  2⤵
  PID:3544
- C:\Windows\System\mEVbosO.exe
  C:\Windows\System\mEVbosO.exe
  2⤵
  PID:3612
- C:\Windows\System\mxJUpqY.exe
  C:\Windows\System\mxJUpqY.exe
  2⤵
  PID:3892
- C:\Windows\System\luNzegB.exe
  C:\Windows\System\luNzegB.exe
  2⤵
  PID:3540
- C:\Windows\System\hooeEkz.exe
  C:\Windows\System\hooeEkz.exe
  2⤵
  PID:3672
- C:\Windows\System\WAMpsoJ.exe
  C:\Windows\System\WAMpsoJ.exe
  2⤵
  PID:3936
- C:\Windows\System\hvqBsVz.exe
  C:\Windows\System\hvqBsVz.exe
  2⤵
  PID:4080
- C:\Windows\System\wqOJTly.exe
  C:\Windows\System\wqOJTly.exe
  2⤵
  PID:1948
- C:\Windows\System\WBYBbLW.exe
  C:\Windows\System\WBYBbLW.exe
  2⤵
  PID:3784
- C:\Windows\System\wAqDTYq.exe
  C:\Windows\System\wAqDTYq.exe
  2⤵
  PID:3800
- C:\Windows\System\ifLHMiW.exe
  C:\Windows\System\ifLHMiW.exe
  2⤵
  PID:3916
- C:\Windows\System\SjsQshL.exe
  C:\Windows\System\SjsQshL.exe
  2⤵
  PID:4024
- C:\Windows\System\uzmlcXq.exe
  C:\Windows\System\uzmlcXq.exe
  2⤵
  PID:2084
- C:\Windows\System\QkkoZEK.exe
  C:\Windows\System\QkkoZEK.exe
  2⤵
  PID:800
- C:\Windows\System\SCOVBrW.exe
  C:\Windows\System\SCOVBrW.exe
  2⤵
  PID:1064
- C:\Windows\System\SFBHBsz.exe
  C:\Windows\System\SFBHBsz.exe
  2⤵
  PID:1344
- C:\Windows\System\IteyStW.exe
  C:\Windows\System\IteyStW.exe
  2⤵
  PID:3356
- C:\Windows\System\wxidzbC.exe
  C:\Windows\System\wxidzbC.exe
  2⤵
  PID:3396
- C:\Windows\System\kZYACsN.exe
  C:\Windows\System\kZYACsN.exe
  2⤵
  PID:3984
- C:\Windows\System\hIpFbVJ.exe
  C:\Windows\System\hIpFbVJ.exe
  2⤵
  PID:1732
- C:\Windows\System\MPvdIKQ.exe
  C:\Windows\System\MPvdIKQ.exe
  2⤵
  PID:4060
- C:\Windows\System\IiBXpwo.exe
  C:\Windows\System\IiBXpwo.exe
  2⤵
  PID:3448
- C:\Windows\System\CPcVMKv.exe
  C:\Windows\System\CPcVMKv.exe
  2⤵
  PID:3768
- C:\Windows\System\EHHSSMm.exe
  C:\Windows\System\EHHSSMm.exe
  2⤵
  PID:1724
- C:\Windows\System\doFpGdk.exe
  C:\Windows\System\doFpGdk.exe
  2⤵
  PID:2044
- C:\Windows\System\VHWKkzh.exe
  C:\Windows\System\VHWKkzh.exe
  2⤵
  PID:2376
- C:\Windows\System\TNvupQZ.exe
  C:\Windows\System\TNvupQZ.exe
  2⤵
  PID:3548
- C:\Windows\System\wsCjLLs.exe
  C:\Windows\System\wsCjLLs.exe
  2⤵
  PID:2140
- C:\Windows\System\UyhZlsW.exe
  C:\Windows\System\UyhZlsW.exe
  2⤵
  PID:3900
- C:\Windows\System\hGgiVxL.exe
  C:\Windows\System\hGgiVxL.exe
  2⤵
  PID:3060
- C:\Windows\System\WwCnHen.exe
  C:\Windows\System\WwCnHen.exe
  2⤵
  PID:3192
- C:\Windows\System\VzTnQzC.exe
  C:\Windows\System\VzTnQzC.exe
  2⤵
  PID:3292
- C:\Windows\System\XEdBltD.exe
  C:\Windows\System\XEdBltD.exe
  2⤵
  PID:3296
- C:\Windows\System\CVJHLGK.exe
  C:\Windows\System\CVJHLGK.exe
  2⤵
  PID:3524
- C:\Windows\System\hPgELVF.exe
  C:\Windows\System\hPgELVF.exe
  2⤵
  PID:2124
- C:\Windows\System\oOqLlQv.exe
  C:\Windows\System\oOqLlQv.exe
  2⤵
  PID:4000
- C:\Windows\System\UkjnKPl.exe
  C:\Windows\System\UkjnKPl.exe
  2⤵
  PID:3756
- C:\Windows\System\kfDpcih.exe
  C:\Windows\System\kfDpcih.exe
  2⤵
  PID:2096
- C:\Windows\System\MhwezAN.exe
  C:\Windows\System\MhwezAN.exe
  2⤵
  PID:3816
- C:\Windows\System\TILWlRK.exe
  C:\Windows\System\TILWlRK.exe
  2⤵
  PID:2288
- C:\Windows\System\yNlrVvZ.exe
  C:\Windows\System\yNlrVvZ.exe
  2⤵
  PID:3068
- C:\Windows\System\SyQKHel.exe
  C:\Windows\System\SyQKHel.exe
  2⤵
  PID:3180
- C:\Windows\System\NtOvVaO.exe
  C:\Windows\System\NtOvVaO.exe
  2⤵
  PID:4016
- C:\Windows\System\zNcmPkI.exe
  C:\Windows\System\zNcmPkI.exe
  2⤵
  PID:3584
- C:\Windows\System\yuEkLar.exe
  C:\Windows\System\yuEkLar.exe
  2⤵
  PID:3912
- C:\Windows\System\kGaFpzD.exe
  C:\Windows\System\kGaFpzD.exe
  2⤵
  PID:1032
- C:\Windows\System\zGTmFol.exe
  C:\Windows\System\zGTmFol.exe
  2⤵
  PID:2360
- C:\Windows\System\jHtxnez.exe
  C:\Windows\System\jHtxnez.exe
  2⤵
  PID:1528
- C:\Windows\System\kDIqBse.exe
  C:\Windows\System\kDIqBse.exe
  2⤵
  PID:1712
- C:\Windows\System\ECIgRSh.exe
  C:\Windows\System\ECIgRSh.exe
  2⤵
  PID:696
- C:\Windows\System\hYbzIPq.exe
  C:\Windows\System\hYbzIPq.exe
  2⤵
  PID:1736
- C:\Windows\System\yGBtPhj.exe
  C:\Windows\System\yGBtPhj.exe
  2⤵
  PID:3416
- C:\Windows\System\ZqesnlL.exe
  C:\Windows\System\ZqesnlL.exe
  2⤵
  PID:448
- C:\Windows\System\jWnKySH.exe
  C:\Windows\System\jWnKySH.exe
  2⤵
  PID:2408
- C:\Windows\System\tDbmaQj.exe
  C:\Windows\System\tDbmaQj.exe
  2⤵
  PID:3740
- C:\Windows\System\NYrSfsR.exe
  C:\Windows\System\NYrSfsR.exe
  2⤵
  PID:3336
- C:\Windows\System\jpGeQfU.exe
  C:\Windows\System\jpGeQfU.exe
  2⤵
  PID:3668
- C:\Windows\System\rrQHUvA.exe
  C:\Windows\System\rrQHUvA.exe
  2⤵
  PID:3708
- C:\Windows\System\noZzmPh.exe
  C:\Windows\System\noZzmPh.exe
  2⤵
  PID:3568
- C:\Windows\System\nimDHko.exe
  C:\Windows\System\nimDHko.exe
  2⤵
  PID:2616
- C:\Windows\System\kQSXyPH.exe
  C:\Windows\System\kQSXyPH.exe
  2⤵
  PID:3128
- C:\Windows\System\mfPHQUt.exe
  C:\Windows\System\mfPHQUt.exe
  2⤵
  PID:2312
- C:\Windows\System\WlyHXDZ.exe
  C:\Windows\System\WlyHXDZ.exe
  2⤵
  PID:3004
- C:\Windows\System\AbMoaNn.exe
  C:\Windows\System\AbMoaNn.exe
  2⤵
  PID:3952
- C:\Windows\System\uBPdusb.exe
  C:\Windows\System\uBPdusb.exe
  2⤵
  PID:1036
- C:\Windows\System\vKzngPO.exe
  C:\Windows\System\vKzngPO.exe
  2⤵
  PID:2884
- C:\Windows\System\WtLnTgW.exe
  C:\Windows\System\WtLnTgW.exe
  2⤵
  PID:3000
- C:\Windows\System\zmoTWUI.exe
  C:\Windows\System\zmoTWUI.exe
  2⤵
  PID:2528
- C:\Windows\System\EfPpqOi.exe
  C:\Windows\System\EfPpqOi.exe
  2⤵
  PID:840
- C:\Windows\System\rvFhGYg.exe
  C:\Windows\System\rvFhGYg.exe
  2⤵
  PID:900
- C:\Windows\System\mjHePdN.exe
  C:\Windows\System\mjHePdN.exe
  2⤵
  PID:2844
- C:\Windows\System\rPsorAM.exe
  C:\Windows\System\rPsorAM.exe
  2⤵
  PID:1096
- C:\Windows\System\DzxqeQB.exe
  C:\Windows\System\DzxqeQB.exe
  2⤵
  PID:3840
- C:\Windows\System\PhPybjJ.exe
  C:\Windows\System\PhPybjJ.exe
  2⤵
  PID:4044
- C:\Windows\System\xduqYGU.exe
  C:\Windows\System\xduqYGU.exe
  2⤵
  PID:3972
- C:\Windows\System\ZvqXPqy.exe
  C:\Windows\System\ZvqXPqy.exe
  2⤵
  PID:2896
- C:\Windows\System\HHJakKY.exe
  C:\Windows\System\HHJakKY.exe
  2⤵
  PID:2904
- C:\Windows\System\PyHcwyr.exe
  C:\Windows\System\PyHcwyr.exe
  2⤵
  PID:4064
- C:\Windows\System\AcEJsfQ.exe
  C:\Windows\System\AcEJsfQ.exe
  2⤵
  PID:3124
- C:\Windows\System\DNqMlLU.exe
  C:\Windows\System\DNqMlLU.exe
  2⤵
  PID:2872
- C:\Windows\System\zwsUdMW.exe
  C:\Windows\System\zwsUdMW.exe
  2⤵
  PID:3320
- C:\Windows\System\ncjwedC.exe
  C:\Windows\System\ncjwedC.exe
  2⤵
  PID:3412
- C:\Windows\System\BDstWWR.exe
  C:\Windows\System\BDstWWR.exe
  2⤵
  PID:2928
- C:\Windows\System\DzpADba.exe
  C:\Windows\System\DzpADba.exe
  2⤵
  PID:2964
- C:\Windows\System\cKJftlK.exe
  C:\Windows\System\cKJftlK.exe
  2⤵
  PID:2848
- C:\Windows\System\yqSouVz.exe
  C:\Windows\System\yqSouVz.exe
  2⤵
  PID:3932
- C:\Windows\System\iROJGXe.exe
  C:\Windows\System\iROJGXe.exe
  2⤵
  PID:3032
- C:\Windows\System\jcKdyVY.exe
  C:\Windows\System\jcKdyVY.exe
  2⤵
  PID:4032
- C:\Windows\System\FQzBIDd.exe
  C:\Windows\System\FQzBIDd.exe
  2⤵
  PID:2708
- C:\Windows\System\HdrykkF.exe
  C:\Windows\System\HdrykkF.exe
  2⤵
  PID:3512
- C:\Windows\System\yDKhFEd.exe
  C:\Windows\System\yDKhFEd.exe
  2⤵
  PID:1068
- C:\Windows\System\pOuVihg.exe
  C:\Windows\System\pOuVihg.exe
  2⤵
  PID:2800
- C:\Windows\System\sGUmYJp.exe
  C:\Windows\System\sGUmYJp.exe
  2⤵
  PID:3400
- C:\Windows\System\jrbEbAV.exe
  C:\Windows\System\jrbEbAV.exe
  2⤵
  PID:1012
- C:\Windows\System\WrrBBmy.exe
  C:\Windows\System\WrrBBmy.exe
  2⤵
  PID:3580
- C:\Windows\System\XKnTGQC.exe
  C:\Windows\System\XKnTGQC.exe
  2⤵
  PID:3016
- C:\Windows\System\GawPJGK.exe
  C:\Windows\System\GawPJGK.exe
  2⤵
  PID:2968
- C:\Windows\System\dCwRXlF.exe
  C:\Windows\System\dCwRXlF.exe
  2⤵
  PID:1420
- C:\Windows\System\UmExihB.exe
  C:\Windows\System\UmExihB.exe
  2⤵
  PID:1480
- C:\Windows\System\vulbUGH.exe
  C:\Windows\System\vulbUGH.exe
  2⤵
  PID:2772
- C:\Windows\System\UUyaPxd.exe
  C:\Windows\System\UUyaPxd.exe
  2⤵
  PID:4048
- C:\Windows\System\CzJyOpx.exe
  C:\Windows\System\CzJyOpx.exe
  2⤵
  PID:3260
- C:\Windows\System\IjcCMQa.exe
  C:\Windows\System\IjcCMQa.exe
  2⤵
  PID:3696
- C:\Windows\System\GnjDGej.exe
  C:\Windows\System\GnjDGej.exe
  2⤵
  PID:1924
- C:\Windows\System\fWdExYB.exe
  C:\Windows\System\fWdExYB.exe
  2⤵
  PID:1828
- C:\Windows\System\ODUWCBR.exe
  C:\Windows\System\ODUWCBR.exe
  2⤵
  PID:4124
- C:\Windows\System\OjLOsPs.exe
  C:\Windows\System\OjLOsPs.exe
  2⤵
  PID:4160
- C:\Windows\System\SsCtUxe.exe
  C:\Windows\System\SsCtUxe.exe
  2⤵
  PID:4184
- C:\Windows\System\TYYTuXI.exe
  C:\Windows\System\TYYTuXI.exe
  2⤵
  PID:4200
- C:\Windows\System\fcLQCxn.exe
  C:\Windows\System\fcLQCxn.exe
  2⤵
  PID:4220
- C:\Windows\System\YwNfXuV.exe
  C:\Windows\System\YwNfXuV.exe
  2⤵
  PID:4236
- C:\Windows\System\djyeRuc.exe
  C:\Windows\System\djyeRuc.exe
  2⤵
  PID:4256
- C:\Windows\System\tHTmEtc.exe
  C:\Windows\System\tHTmEtc.exe
  2⤵
  PID:4272
- C:\Windows\System\emHKgHg.exe
  C:\Windows\System\emHKgHg.exe
  2⤵
  PID:4292
- C:\Windows\System\lgJHYlN.exe
  C:\Windows\System\lgJHYlN.exe
  2⤵
  PID:4308
- C:\Windows\System\KPmFzBi.exe
  C:\Windows\System\KPmFzBi.exe
  2⤵
  PID:4324
- C:\Windows\System\zhcnOkC.exe
  C:\Windows\System\zhcnOkC.exe
  2⤵
  PID:4340
- C:\Windows\System\gstZiNw.exe
  C:\Windows\System\gstZiNw.exe
  2⤵
  PID:4356
- C:\Windows\System\VcwpimB.exe
  C:\Windows\System\VcwpimB.exe
  2⤵
  PID:4372
- C:\Windows\System\qXEYvQi.exe
  C:\Windows\System\qXEYvQi.exe
  2⤵
  PID:4392
- C:\Windows\System\fcydUhU.exe
  C:\Windows\System\fcydUhU.exe
  2⤵
  PID:4412
- C:\Windows\System\LotgGeF.exe
  C:\Windows\System\LotgGeF.exe
  2⤵
  PID:4428
- C:\Windows\System\ETLzkrR.exe
  C:\Windows\System\ETLzkrR.exe
  2⤵
  PID:4448
- C:\Windows\System\hAsFsqv.exe
  C:\Windows\System\hAsFsqv.exe
  2⤵
  PID:4464
- C:\Windows\System\EmefVHE.exe
  C:\Windows\System\EmefVHE.exe
  2⤵
  PID:4480
- C:\Windows\System\YTlhgWv.exe
  C:\Windows\System\YTlhgWv.exe
  2⤵
  PID:4500
- C:\Windows\System\oNLLUpN.exe
  C:\Windows\System\oNLLUpN.exe
  2⤵
  PID:4516
- C:\Windows\System\ciQIzXH.exe
  C:\Windows\System\ciQIzXH.exe
  2⤵
  PID:4536
- C:\Windows\System\HYbdtvQ.exe
  C:\Windows\System\HYbdtvQ.exe
  2⤵
  PID:4552
- C:\Windows\System\tBMfMcf.exe
  C:\Windows\System\tBMfMcf.exe
  2⤵
  PID:4572
- C:\Windows\System\MdknmMB.exe
  C:\Windows\System\MdknmMB.exe
  2⤵
  PID:4588
- C:\Windows\System\drZxZLi.exe
  C:\Windows\System\drZxZLi.exe
  2⤵
  PID:4608
- C:\Windows\System\NHCVttS.exe
  C:\Windows\System\NHCVttS.exe
  2⤵
  PID:4624
- C:\Windows\System\bPcELRW.exe
  C:\Windows\System\bPcELRW.exe
  2⤵
  PID:4640
- C:\Windows\System\rcGDdxK.exe
  C:\Windows\System\rcGDdxK.exe
  2⤵
  PID:4656
- C:\Windows\System\pAXMQon.exe
  C:\Windows\System\pAXMQon.exe
  2⤵
  PID:4672
- C:\Windows\System\dbEfnxY.exe
  C:\Windows\System\dbEfnxY.exe
  2⤵
  PID:4688
- C:\Windows\System\MpeyYrt.exe
  C:\Windows\System\MpeyYrt.exe
  2⤵
  PID:4704
- C:\Windows\System\sbDtRUP.exe
  C:\Windows\System\sbDtRUP.exe
  2⤵
  PID:4720
- C:\Windows\System\MdTumzI.exe
  C:\Windows\System\MdTumzI.exe
  2⤵
  PID:4736
- C:\Windows\System\MnvYXPU.exe
  C:\Windows\System\MnvYXPU.exe
  2⤵
  PID:4752
- C:\Windows\System\yGPqKHj.exe
  C:\Windows\System\yGPqKHj.exe
  2⤵
  PID:4776
- C:\Windows\System\fvngyPm.exe
  C:\Windows\System\fvngyPm.exe
  2⤵
  PID:4796
- C:\Windows\System\atXphcC.exe
  C:\Windows\System\atXphcC.exe
  2⤵
  PID:4812
- C:\Windows\System\fVnSqQP.exe
  C:\Windows\System\fVnSqQP.exe
  2⤵
  PID:4836
- C:\Windows\System\VaYJKpM.exe
  C:\Windows\System\VaYJKpM.exe
  2⤵
  PID:4852
- C:\Windows\System\ghPrubC.exe
  C:\Windows\System\ghPrubC.exe
  2⤵
  PID:4868
- C:\Windows\System\lcfuKJu.exe
  C:\Windows\System\lcfuKJu.exe
  2⤵
  PID:4884
- C:\Windows\System\MBrCyyq.exe
  C:\Windows\System\MBrCyyq.exe
  2⤵
  PID:4900
- C:\Windows\System\BkMxaKl.exe
  C:\Windows\System\BkMxaKl.exe
  2⤵
  PID:4916
- C:\Windows\System\mdNEMhc.exe
  C:\Windows\System\mdNEMhc.exe
  2⤵
  PID:4932
- C:\Windows\System\jhoSORc.exe
  C:\Windows\System\jhoSORc.exe
  2⤵
  PID:4948
- C:\Windows\System\irOxxFZ.exe
  C:\Windows\System\irOxxFZ.exe
  2⤵
  PID:4964
- C:\Windows\System\rSQsegf.exe
  C:\Windows\System\rSQsegf.exe
  2⤵
  PID:4984
- C:\Windows\System\oGJSOGl.exe
  C:\Windows\System\oGJSOGl.exe
  2⤵
  PID:5000
- C:\Windows\System\IDqOAXX.exe
  C:\Windows\System\IDqOAXX.exe
  2⤵
  PID:5016
- C:\Windows\System\PLqdTRN.exe
  C:\Windows\System\PLqdTRN.exe
  2⤵
  PID:5032
- C:\Windows\System\mSEaRbK.exe
  C:\Windows\System\mSEaRbK.exe
  2⤵
  PID:5048
- C:\Windows\System\wImJlGM.exe
  C:\Windows\System\wImJlGM.exe
  2⤵
  PID:5064
- C:\Windows\System\JxSXpjj.exe
  C:\Windows\System\JxSXpjj.exe
  2⤵
  PID:5080
- C:\Windows\System\iHJYbnA.exe
  C:\Windows\System\iHJYbnA.exe
  2⤵
  PID:5096
- C:\Windows\System\zXLsAlp.exe
  C:\Windows\System\zXLsAlp.exe
  2⤵
  PID:5112
- C:\Windows\System\qwDfhAf.exe
  C:\Windows\System\qwDfhAf.exe
  2⤵
  PID:1272
- C:\Windows\System\nBCPKwD.exe
  C:\Windows\System\nBCPKwD.exe
  2⤵
  PID:3692
- C:\Windows\System\HIZaUSy.exe
  C:\Windows\System\HIZaUSy.exe
  2⤵
  PID:2492
- C:\Windows\System\SNRGWsG.exe
  C:\Windows\System\SNRGWsG.exe
  2⤵
  PID:4120
- C:\Windows\System\SUhOqVH.exe
  C:\Windows\System\SUhOqVH.exe
  2⤵
  PID:4144
- C:\Windows\System\kuHaHuR.exe
  C:\Windows\System\kuHaHuR.exe
  2⤵
  PID:4196
- C:\Windows\System\VJGwjxQ.exe
  C:\Windows\System\VJGwjxQ.exe
  2⤵
  PID:4264
- C:\Windows\System\gcIuRHq.exe
  C:\Windows\System\gcIuRHq.exe
  2⤵
  PID:4332
- C:\Windows\System\mopermx.exe
  C:\Windows\System\mopermx.exe
  2⤵
  PID:4400
- C:\Windows\System\GZpnkuw.exe
  C:\Windows\System\GZpnkuw.exe
  2⤵
  PID:4444
- C:\Windows\System\OuEsfTP.exe
  C:\Windows\System\OuEsfTP.exe
  2⤵
  PID:4512
- C:\Windows\System\nXCaJub.exe
  C:\Windows\System\nXCaJub.exe
  2⤵
  PID:4584
- C:\Windows\System\xdJcgBR.exe
  C:\Windows\System\xdJcgBR.exe
  2⤵
  PID:4420
- C:\Windows\System\mzvENBv.exe
  C:\Windows\System\mzvENBv.exe
  2⤵
  PID:4596
- C:\Windows\System\vRUZFXi.exe
  C:\Windows\System\vRUZFXi.exe
  2⤵
  PID:4216
- C:\Windows\System\DzStYKx.exe
  C:\Windows\System\DzStYKx.exe
  2⤵
  PID:4252
- C:\Windows\System\QYKUoQJ.exe
  C:\Windows\System\QYKUoQJ.exe
  2⤵
  PID:4316
- C:\Windows\System\KhwBKdH.exe
  C:\Windows\System\KhwBKdH.exe
  2⤵
  PID:4380
- C:\Windows\System\fYVuJKq.exe
  C:\Windows\System\fYVuJKq.exe
  2⤵
  PID:4456
- C:\Windows\System\FDwvdgs.exe
  C:\Windows\System\FDwvdgs.exe
  2⤵
  PID:4496
- C:\Windows\System\pzasojL.exe
  C:\Windows\System\pzasojL.exe
  2⤵
  PID:4564
- C:\Windows\System\KKAbrXZ.exe
  C:\Windows\System\KKAbrXZ.exe
  2⤵
  PID:4632
- C:\Windows\System\ItwMWjI.exe
  C:\Windows\System\ItwMWjI.exe
  2⤵
  PID:4700
- C:\Windows\System\RWNWKPw.exe
  C:\Windows\System\RWNWKPw.exe
  2⤵
  PID:4620
- C:\Windows\System\LxyEfaa.exe
  C:\Windows\System\LxyEfaa.exe
  2⤵
  PID:4748
- C:\Windows\System\cfcyzwK.exe
  C:\Windows\System\cfcyzwK.exe
  2⤵
  PID:4652
- C:\Windows\System\mUOUkyD.exe
  C:\Windows\System\mUOUkyD.exe
  2⤵
  PID:4808
- C:\Windows\System\EZcKnNj.exe
  C:\Windows\System\EZcKnNj.exe
  2⤵
  PID:4792
- C:\Windows\System\sITZPLZ.exe
  C:\Windows\System\sITZPLZ.exe
  2⤵
  PID:4832
- C:\Windows\System\KifNsPl.exe
  C:\Windows\System\KifNsPl.exe
  2⤵
  PID:4896
- C:\Windows\System\imlQrLs.exe
  C:\Windows\System\imlQrLs.exe
  2⤵
  PID:4960
- C:\Windows\System\nIRsmcv.exe
  C:\Windows\System\nIRsmcv.exe
  2⤵
  PID:5008
- C:\Windows\System\maxoeex.exe
  C:\Windows\System\maxoeex.exe
  2⤵
  PID:4912
- C:\Windows\System\PXjquPM.exe
  C:\Windows\System\PXjquPM.exe
  2⤵
  PID:4976
- C:\Windows\System\xTVSpzE.exe
  C:\Windows\System\xTVSpzE.exe
  2⤵
  PID:5056
- C:\Windows\System\VypSrPc.exe
  C:\Windows\System\VypSrPc.exe
  2⤵
  PID:1860
- C:\Windows\System\dPWOdmX.exe
  C:\Windows\System\dPWOdmX.exe
  2⤵
  PID:2436
- C:\Windows\System\mtByqbg.exe
  C:\Windows\System\mtByqbg.exe
  2⤵
  PID:4232
- C:\Windows\System\HxMebWj.exe
  C:\Windows\System\HxMebWj.exe
  2⤵
  PID:4508
- C:\Windows\System\LyuLuFX.exe
  C:\Windows\System\LyuLuFX.exe
  2⤵
  PID:4212
- C:\Windows\System\dcplSBI.exe
  C:\Windows\System\dcplSBI.exe
  2⤵
  PID:5044
- C:\Windows\System\AwlfiQW.exe
  C:\Windows\System\AwlfiQW.exe
  2⤵
  PID:5108
- C:\Windows\System\GksXgWx.exe
  C:\Windows\System\GksXgWx.exe
  2⤵
  PID:4116
- C:\Windows\System\bdJwDtD.exe
  C:\Windows\System\bdJwDtD.exe
  2⤵
  PID:4408
- C:\Windows\System\HpTCaLY.exe
  C:\Windows\System\HpTCaLY.exe
  2⤵
  PID:4560
- C:\Windows\System\hSLwTTR.exe
  C:\Windows\System\hSLwTTR.exe
  2⤵
  PID:4388
- C:\Windows\System\XUdbTHD.exe
  C:\Windows\System\XUdbTHD.exe
  2⤵
  PID:4288
- C:\Windows\System\tVJurPc.exe
  C:\Windows\System\tVJurPc.exe
  2⤵
  PID:4712
- C:\Windows\System\isqajdB.exe
  C:\Windows\System\isqajdB.exe
  2⤵
  PID:4828
- C:\Windows\System\bYiTIqu.exe
  C:\Windows\System\bYiTIqu.exe
  2⤵
  PID:4928
- C:\Windows\System\hkcfIRf.exe
  C:\Windows\System\hkcfIRf.exe
  2⤵
  PID:4908
- C:\Windows\System\xFIVETj.exe
  C:\Windows\System\xFIVETj.exe
  2⤵
  PID:4760
- C:\Windows\System\XzWCzaS.exe
  C:\Windows\System\XzWCzaS.exe
  2⤵
  PID:4788
- C:\Windows\System\DaqDiGJ.exe
  C:\Windows\System\DaqDiGJ.exe
  2⤵
  PID:4992
- C:\Windows\System\PorHILk.exe
  C:\Windows\System\PorHILk.exe
  2⤵
  PID:5024
- C:\Windows\System\LIEmPyf.exe
  C:\Windows\System\LIEmPyf.exe
  2⤵
  PID:4476
- C:\Windows\System\ERLrEWw.exe
  C:\Windows\System\ERLrEWw.exe
  2⤵
  PID:4440
- C:\Windows\System\TRJrgtO.exe
  C:\Windows\System\TRJrgtO.exe
  2⤵
  PID:5028
- C:\Windows\System\kjPomGC.exe
  C:\Windows\System\kjPomGC.exe
  2⤵
  PID:4824
- C:\Windows\System\hriuxuH.exe
  C:\Windows\System\hriuxuH.exe
  2⤵
  PID:4744
- C:\Windows\System\FYmRzvp.exe
  C:\Windows\System\FYmRzvp.exe
  2⤵
  PID:3344
- C:\Windows\System\FMmlcEi.exe
  C:\Windows\System\FMmlcEi.exe
  2⤵
  PID:5136
- C:\Windows\System\nFYBMpu.exe
  C:\Windows\System\nFYBMpu.exe
  2⤵
  PID:5152
- C:\Windows\System\gQJMyYP.exe
  C:\Windows\System\gQJMyYP.exe
  2⤵
  PID:5168
- C:\Windows\System\reKnBtf.exe
  C:\Windows\System\reKnBtf.exe
  2⤵
  PID:5184
- C:\Windows\System\AOpqDKH.exe
  C:\Windows\System\AOpqDKH.exe
  2⤵
  PID:5200
- C:\Windows\System\EQLsiEg.exe
  C:\Windows\System\EQLsiEg.exe
  2⤵
  PID:5216
- C:\Windows\System\hBymZcK.exe
  C:\Windows\System\hBymZcK.exe
  2⤵
  PID:5232
- C:\Windows\System\keYFTlU.exe
  C:\Windows\System\keYFTlU.exe
  2⤵
  PID:5248
- C:\Windows\System\EJvaJQR.exe
  C:\Windows\System\EJvaJQR.exe
  2⤵
  PID:5264
- C:\Windows\System\rOGfVDO.exe
  C:\Windows\System\rOGfVDO.exe
  2⤵
  PID:5280
- C:\Windows\System\lIrgRWJ.exe
  C:\Windows\System\lIrgRWJ.exe
  2⤵
  PID:5296
- C:\Windows\System\EmaXqgr.exe
  C:\Windows\System\EmaXqgr.exe
  2⤵
  PID:5312
- C:\Windows\System\ugakmoa.exe
  C:\Windows\System\ugakmoa.exe
  2⤵
  PID:5328
- C:\Windows\System\ossKvuL.exe
  C:\Windows\System\ossKvuL.exe
  2⤵
  PID:5344
- C:\Windows\System\wtzXbwn.exe
  C:\Windows\System\wtzXbwn.exe
  2⤵
  PID:5360
- C:\Windows\System\PgygDDs.exe
  C:\Windows\System\PgygDDs.exe
  2⤵
  PID:5376
- C:\Windows\System\iUDsoRf.exe
  C:\Windows\System\iUDsoRf.exe
  2⤵
  PID:5392
- C:\Windows\System\WpeLcdw.exe
  C:\Windows\System\WpeLcdw.exe
  2⤵
  PID:5408
- C:\Windows\System\fUcJNno.exe
  C:\Windows\System\fUcJNno.exe
  2⤵
  PID:5424
- C:\Windows\System\JlLyZef.exe
  C:\Windows\System\JlLyZef.exe
  2⤵
  PID:5440
- C:\Windows\System\vJFkvZh.exe
  C:\Windows\System\vJFkvZh.exe
  2⤵
  PID:5456
- C:\Windows\System\OHnHxPA.exe
  C:\Windows\System\OHnHxPA.exe
  2⤵
  PID:5472
- C:\Windows\System\nlZJePQ.exe
  C:\Windows\System\nlZJePQ.exe
  2⤵
  PID:5488
- C:\Windows\System\zsBWlZt.exe
  C:\Windows\System\zsBWlZt.exe
  2⤵
  PID:5504
- C:\Windows\System\phMXQPd.exe
  C:\Windows\System\phMXQPd.exe
  2⤵
  PID:5520
- C:\Windows\System\yNfuvpv.exe
  C:\Windows\System\yNfuvpv.exe
  2⤵
  PID:5536
- C:\Windows\System\JMFdaaM.exe
  C:\Windows\System\JMFdaaM.exe
  2⤵
  PID:5552
- C:\Windows\System\RggjzbO.exe
  C:\Windows\System\RggjzbO.exe
  2⤵
  PID:5568
- C:\Windows\System\wwlSwaV.exe
  C:\Windows\System\wwlSwaV.exe
  2⤵
  PID:5584
- C:\Windows\System\WXqKkST.exe
  C:\Windows\System\WXqKkST.exe
  2⤵
  PID:5600
- C:\Windows\System\rdBiMEM.exe
  C:\Windows\System\rdBiMEM.exe
  2⤵
  PID:5616
- C:\Windows\System\kIgHVFA.exe
  C:\Windows\System\kIgHVFA.exe
  2⤵
  PID:5632
- C:\Windows\System\oluEyhJ.exe
  C:\Windows\System\oluEyhJ.exe
  2⤵
  PID:5648
- C:\Windows\System\VRVSXir.exe
  C:\Windows\System\VRVSXir.exe
  2⤵
  PID:5664
- C:\Windows\System\PjVzIlb.exe
  C:\Windows\System\PjVzIlb.exe
  2⤵
  PID:5680
- C:\Windows\System\ueKOeuM.exe
  C:\Windows\System\ueKOeuM.exe
  2⤵
  PID:5696
- C:\Windows\System\uVCLqTd.exe
  C:\Windows\System\uVCLqTd.exe
  2⤵
  PID:5712
- C:\Windows\System\QTfAhKr.exe
  C:\Windows\System\QTfAhKr.exe
  2⤵
  PID:5728
- C:\Windows\System\nwbXlYK.exe
  C:\Windows\System\nwbXlYK.exe
  2⤵
  PID:5744
- C:\Windows\System\PNAxXDP.exe
  C:\Windows\System\PNAxXDP.exe
  2⤵
  PID:5760
- C:\Windows\System\VLbMcMj.exe
  C:\Windows\System\VLbMcMj.exe
  2⤵
  PID:5776
- C:\Windows\System\SZWlpzF.exe
  C:\Windows\System\SZWlpzF.exe
  2⤵
  PID:5792
- C:\Windows\System\ubpNcyD.exe
  C:\Windows\System\ubpNcyD.exe
  2⤵
  PID:5808
- C:\Windows\System\cSyHobD.exe
  C:\Windows\System\cSyHobD.exe
  2⤵
  PID:5824
- C:\Windows\System\QGowaFw.exe
  C:\Windows\System\QGowaFw.exe
  2⤵
  PID:5840
- C:\Windows\System\UQywRzU.exe
  C:\Windows\System\UQywRzU.exe
  2⤵
  PID:5856
- C:\Windows\System\QuJhSvH.exe
  C:\Windows\System\QuJhSvH.exe
  2⤵
  PID:5872
- C:\Windows\System\HhigMEd.exe
  C:\Windows\System\HhigMEd.exe
  2⤵
  PID:5888
- C:\Windows\System\mWvApVa.exe
  C:\Windows\System\mWvApVa.exe
  2⤵
  PID:5904
- C:\Windows\System\QdPGSbi.exe
  C:\Windows\System\QdPGSbi.exe
  2⤵
  PID:5920
- C:\Windows\System\AcJdkXR.exe
  C:\Windows\System\AcJdkXR.exe
  2⤵
  PID:5936
- C:\Windows\System\TvJGsSa.exe
  C:\Windows\System\TvJGsSa.exe
  2⤵
  PID:5952
- C:\Windows\System\DxzHJIl.exe
  C:\Windows\System\DxzHJIl.exe
  2⤵
  PID:5968
- C:\Windows\System\OTVUKeK.exe
  C:\Windows\System\OTVUKeK.exe
  2⤵
  PID:5984
- C:\Windows\System\tvVEBwl.exe
  C:\Windows\System\tvVEBwl.exe
  2⤵
  PID:6000
- C:\Windows\System\AjUnhcb.exe
  C:\Windows\System\AjUnhcb.exe
  2⤵
  PID:6016
- C:\Windows\System\FDUawxE.exe
  C:\Windows\System\FDUawxE.exe
  2⤵
  PID:6032
- C:\Windows\System\tmlFmuQ.exe
  C:\Windows\System\tmlFmuQ.exe
  2⤵
  PID:6048
- C:\Windows\System\EeASKWI.exe
  C:\Windows\System\EeASKWI.exe
  2⤵
  PID:6064
- C:\Windows\System\EoZaiEc.exe
  C:\Windows\System\EoZaiEc.exe
  2⤵
  PID:6080
- C:\Windows\System\OtReXYU.exe
  C:\Windows\System\OtReXYU.exe
  2⤵
  PID:6096
- C:\Windows\System\QblZyyu.exe
  C:\Windows\System\QblZyyu.exe
  2⤵
  PID:6112
- C:\Windows\System\RyieIBP.exe
  C:\Windows\System\RyieIBP.exe
  2⤵
  PID:6128
- C:\Windows\System\oBQsNfK.exe
  C:\Windows\System\oBQsNfK.exe
  2⤵
  PID:2516
- C:\Windows\System\jUshJbO.exe
  C:\Windows\System\jUshJbO.exe
  2⤵
  PID:5144
- C:\Windows\System\ASkEUfH.exe
  C:\Windows\System\ASkEUfH.exe
  2⤵
  PID:5208
- C:\Windows\System\ANDdUQT.exe
  C:\Windows\System\ANDdUQT.exe
  2⤵
  PID:5276
- C:\Windows\System\mtBMJYk.exe
  C:\Windows\System\mtBMJYk.exe
  2⤵
  PID:5076
- C:\Windows\System\yJKMaQS.exe
  C:\Windows\System\yJKMaQS.exe
  2⤵
  PID:4304
- C:\Windows\System\EYFqNpI.exe
  C:\Windows\System\EYFqNpI.exe
  2⤵
  PID:4488
- C:\Windows\System\yzNBKfV.exe
  C:\Windows\System\yzNBKfV.exe
  2⤵
  PID:4248
- C:\Windows\System\uvdkfag.exe
  C:\Windows\System\uvdkfag.exe
  2⤵
  PID:4680
- C:\Windows\System\LNvfXwe.exe
  C:\Windows\System\LNvfXwe.exe
  2⤵
  PID:4892
- C:\Windows\System\idOtQUo.exe
  C:\Windows\System\idOtQUo.exe
  2⤵
  PID:4180
- C:\Windows\System\BJmjuYK.exe
  C:\Windows\System\BJmjuYK.exe
  2⤵
  PID:5132
- C:\Windows\System\NcHpPcu.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes